Closed Bug 583598 Opened 14 years ago Closed 14 years ago

GC-related JS_ASSERT (Conservative GC scanner has missed the root ...) on test_closeOnGC.html/test_location.html/test_xhr.html

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Windows Server 2003
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
blocking2.0 --- betaN+

People

(Reporter: dbaron, Assigned: gwagner)

References

Details

(Keywords: intermittent-failure, Whiteboard: fixed-in-tracemonkey, )

Attachments

(3 files, 1 obsolete file)

stack from log in comment 0
8.32 KB, text/plain
Details
stack
8.32 KB, text/plain
Details
patch
1.18 KB, patch
igor
: review+
Details | Diff | Splinter Review
Maybe related to bug 583554, but I'm filing separately since it's a different assertion. http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1280667156.1280668037.6482.gz WINNT 5.2 mozilla-central debug test mochitests-2/5 Conservative GC scanner has missed the root 077AE120 with tag 4294967285 on the stack. Aborting. Assertion failure: false, at e:/builds/moz2_slave/mozilla-central-win32-debug/build/js/src/jsgc.cpp:2538 TEST-UNEXPECTED-FAIL | /tests/dom/src/threads/test/test_closeOnGC.html | Exited with code -1073741819 during test run
Blocks: 438871
Whiteboard: [orange]
Attached file stack —
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1280667535.1280668429.8280.gz WINNT 5.2 mozilla-central debug test mochitests-2/5 Conservative GC scanner has missed the root 0DE9C090 with tag 4294967285 on the stack. Aborting. Assertion failure: false, at e:/builds/moz2_slave/mozilla-central-win32-debug/build/js/src/jsgc.cpp:2538
blocking2.0: --- → beta3+
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1280688584.1280689352.13395.gz Conservative GC scanner has missed the root 076C0900 with tag 4294967285 on the stack. Aborting. Assertion failure: false, at e:/builds/moz2_slave/mozilla-central-win32-debug/build/js/src/jsgc.cpp:2538
I do not see from the stack traces what causes this test failures on Windows. My plan is to add more debug printouts so it would be easy to judge from the stack traces what is going on.
Depends on: 583763
Blocks: 574313
blocking2.0: beta3+ → betaN+
Summary: GC-related JS_ASSERT (Conservative GC scanner has missed the root ...) on dom/src/threads/test/test_closeOnGC.html → GC-related JS_ASSERT (Conservative GC scanner has missed the root ...) on test_closeOnGC.html/test_location.html
It seems that we don't mark the roots. 0 means that we have a valid word. Maybe we are in JSRTS_LANDING mode? Conservative GC scanner has missed the root 09B2E090 with tag -11 on the stack due to 0. Aborting. Assertion failure: false, at e:/builds/moz2_slave/tracemonkey-win32-debug/build/js/src/jsgc.cpp:2501 nsStringStats => mAllocCount: 391340 => mReallocCount: 26817 => mFreeCount: 355359 -- LEAKED 35981 !!! => mShareCount: 667973 => mAdoptCount: 43127 => mAdoptFreeCount: 43125 -- LEAKED 2 !!! NEXT ERROR TEST-UNEXPECTED-FAIL | /tests/dom/src/threads/test/test_closeOnGC.html | Exited with code -1073741819 during test run
(In reply to comment #16) > It seems that we don't mark the roots. 0 means that we have a valid word. Maybe > we are in JSRTS_LANDING mode? Landing would imply js_DestroyContext on the stack. But those are absent. Another puzzle is that the bug shows up only on Windows with platform-neutral stack traces. I am going to add even more to the abort output to help to locate the source of the bug.
Attached patch patch (obsolete) — — Splinter Review
This seems to be some nasty threading bug. I don't see any assertions any more with this patch.
Attachment #463843 - Flags: review?(igor)
Attached patch patch — — Splinter Review
And with the right version...
Attachment #463843 - Attachment is obsolete: true
Attachment #463843 - Flags: review?(igor)
Attachment #463844 - Flags: review?(igor)
Comment on attachment 463844 [details] [diff] [review] patch >diff -r bdd944b09a53 js/src/jsapi.cpp >--- a/js/src/jsapi.cpp Fri Aug 06 21:45:25 2010 +0200 >+++ b/js/src/jsapi.cpp Sat Aug 07 14:52:49 2010 -0700 >@@ -891,43 +891,41 @@ JS_YieldRequest(JSContext *cx) > JS_PUBLIC_API(jsrefcount) > JS_SuspendRequest(JSContext *cx) > { > #ifdef JS_THREADSAFE > jsrefcount saveDepth = cx->requestDepth; > if (saveDepth == 0) > return 0; > >+ JS_THREAD_DATA(cx)->conservativeGC.enable(); > do { > cx->outstandingRequests++; /* compensate for StopRequest */ > StopRequest(cx); > } while (cx->requestDepth); > >- JS_THREAD_DATA(cx)->conservativeGC.enable(); >- > return saveDepth; > #else > return 0; > #endif > } > > JS_PUBLIC_API(void) > JS_ResumeRequest(JSContext *cx, jsrefcount saveDepth) > { > #ifdef JS_THREADSAFE > if (saveDepth == 0) > return; > >- JS_THREAD_DATA(cx)->conservativeGC.disable(); >- > JS_ASSERT(cx->outstandingRequests != 0); > do { > JS_BeginRequest(cx); > cx->outstandingRequests--; /* compensate for JS_BeginRequest */ > } while (--saveDepth != 0); >+ JS_THREAD_DATA(cx)->conservativeGC.disable(); > #endif > } > > JS_PUBLIC_API(void) > JS_Lock(JSRuntime *rt) > { > JS_LOCK_RUNTIME(rt); > }
Attachment #463844 - Flags: review?(igor) → review+
(In reply to comment #26) > Created attachment 463844 [details] [diff] [review] > patch > > And with the right version... This is a nice catch!
Nice work Gregor.
Assignee: general → anygregor
http://hg.mozilla.org/tracemonkey/rev/a439319b1e3d
Assignee: anygregor → general
Whiteboard: [orange] → fixed-in-tracemonkey
Assignee: general → anygregor
So a conservative GC was racing with a JS_SuspendRequest? /be
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1281255272.1281256106.5995.gz#err0 s: win32-slave54 TEST-UNEXPECTED-FAIL | /tests/dom/src/threads/test/test_closeOnGC.html | Exited with code -1073741819 during test run PROCESS-CRASH | /tests/dom/src/threads/test/test_closeOnGC.html | application crashed (minidump found) Thread 0 (crashed) TEST-UNEXPECTED-FAIL | automationutils.processLeakLog() | missing output line for total leaks!
(In reply to comment #32) > So a conservative GC was racing with a JS_SuspendRequest? > Yes.
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1281283597.1281284498.25649.gz
Summary: GC-related JS_ASSERT (Conservative GC scanner has missed the root ...) on test_closeOnGC.html/test_location.html → GC-related JS_ASSERT (Conservative GC scanner has missed the root ...) on test_closeOnGC.html/test_location.html/test_xhr.html
Whiteboard: fixed-in-tracemonkey → fixed-in-tracemonkey, [orange]
FTR we've been seeing this on Thunderbird bloat builders as well.
http://hg.mozilla.org/mozilla-central/rev/a439319b1e3d
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-tracemonkey, [orange] → fixed-in-tracemonkey,
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: